SEC Risk Alert Highlights Investment Adviser Annual Compliance Review Weaknesses

On September 14, 2026, the SEC’s Division of Examinations (the “Division”) published a Risk Alert highlighting examination observations regarding investment adviser annual compliance reviews under Rule 206(4)-7 of the Investment Advisers Act of 1940, as amended (the “Compliance Rule”). The Compliance Rule requires SEC-registered advisers to adopt written compliance policies, review them at least annually for adequacy and effectiveness, and designate a chief compliance officer (“CCO”). Despite the Compliance Rule’s long history, the Division found persistent and widespread deficiencies across the firms it examined.

Key Problem Areas Identified by SEC Staff

Untimely or Uncompleted Annual Reviews: The SEC Staff observed gaps in review years (e.g., advisers failed to conduct reviews at least annually), reviews performed and stretching to periods greater than 12 months, and extended intervals caused by CCO departures or operational changes. In some cases, advisers substituted compliance training or employee attestations for the required annual review, which does not satisfy the Compliance Rule. The SEC Staff also identified repeat offenders, having failed to take corrective action regarding annual reviews in response to previous deficiency letters.

Incomplete Policies and Procedures: Advisers had policies requiring annual reviews but lacked actual procedures to guide personnel on how to conduct assessments, including what tests to perform, what factors to evaluate, and what documentation to maintain. Some policies identified specific areas that should be reviewed annually but then omitted those same topics from the actual review procedures.

Reviews Inconsistent with Written Procedures: Even when timely reviews were conducted, advisers often did not follow their own written procedures. Advisers failed to cover the defined scope, use required workpapers, perform specified tasks, or, in some cases, assessed outdated, superseded versions of their own policies and procedures.

Misalignment Between Policies and Actual Practices: Annual reviews failed to catch critical gaps, including:

• Fee and billing practices that were inconsistent with client disclosures and advisory agreements;
• Proxy voting policies that stated the adviser would vote proxies, but the adviser actually did not;
• Custody procedures that omitted steps for identifying accounts subject to surprise examination under Rule 206(4)-2;
• Marketing policies that were not updated for the 2022 Marketing Rule (Rule 206(4)-1) amendments;
• Missing Form CRS (Part 3 of Form ADV) filing procedures for advisers with retail clients;
• Policies delegating services and operations without oversight procedures to prevent Advisers Act violations; and
• Unreported incidents of non-compliance discovered during the review period.

Poor Documentation Practices: Advisers created documentation during annual reviews — testing records, corrective action recommendations — but failed to maintain it in their books and records as required by Rule 204-2. Some advisers’ policies required written annual review reports covering specific topics, but no such reports were ever prepared. Others only partially completed required checklists or templates.

Failure to Follow Through on Corrective Actions: Most concerning: advisers whose annual reviews identified necessary improvements — such as better proxy voting disclosures, client risk tolerance documentation, or best execution analysis — simply never implemented the recommended changes. In some cases, advisers stated that corrective actions had already been taken when the same issues persisted from prior reviews.

What Should Advisers Do Now?

The Division’s message is clear: the annual compliance review is not a box-checking exercise. Advisers should consider the following steps:

• Audit your review cadence — ensure reviews are conducted at least annually, with no gaps, and document the review period clearly.
• Formalize your procedures — your written compliance manual should include detailed procedures for how personnel conduct the annual review, including testing methodologies and documentation standards.
• Align policies with practice — use the annual review to test whether your written policies actually reflect how your firm operates, especially around fees, proxy voting, custody, marketing, and regulatory filings.
• Maintain your records — all testing documentation, workpapers, findings, and corrective action recommendations must be kept in your books and records under Rule 204-2.
• Close the loop on corrective actions — track every recommendation to completion and verify implementation before the next review cycle.

The full Risk Alert is available here. If your firm hasn’t revisited its annual review process recently, now is the time.